3.5 CVE-2020-24588

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.
https://nvd.nist.gov/vuln/detail/CVE-2020-24588

Categories

CWE-327 : Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol. Automated methods may be useful for recognizing commonly-used libraries or features that have become obsolete. This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. Ensure that the design allows one cryptographic algorithm to be replaced with another in the next generation or version. Where possible, use wrappers to make the interfaces uniform. This will make it easier to upgrade to stronger algorithms. With hardware, design the product at the Intellectual Property (IP) level so that one cryptographic algorithm can be replaced with another in the next generation of the hardware product. Carefully manage and protect cryptographic keys (see CWE-320). If the keys can be guessed or stolen, then the strength of the cryptography itself is irrelevant. When using industry-approved techniques, use them correctly. Don't cut corners by skipping resource-intensive steps (CWE-325). These steps are often essential for preventing common attacks. SCADA-based protocol supports a legacy encryption mode that uses Tiny Encryption Algorithm (TEA) in ECB mode, which leaks patterns in messages and cannot protect integrity Programmable Logic Controller (PLC) uses a protocol with a cryptographically insecure hashing algorithm for passwords. Product uses "ROT-25" to obfuscate the password in the registry. product only uses "XOR" to obfuscate sensitive data product only uses "XOR" and a fixed key to obfuscate sensitive data Product substitutes characters with other characters in a fixed way, and also leaves certain input characters unchanged. Attackers can infer private IP addresses by dividing each octet by the MD5 hash of '20'. Product uses DES when MD5 has been specified in the configuration, resulting in weaker-than-expected password hashes. Default configuration of product uses MD5 instead of stronger algorithms that are available, simplifying forgery of certificates. Product uses the hash of a hash for authentication, allowing attackers to gain privileges if they can obtain the original hash.

References

AFFECTED (from MITRE)

CPE

REMEDIATION

EXPLOITS

Exploit-db.com

POC Github

Other Nist (github, ...)

CAPEC

Common Attack Pattern Enumerations and Classifications

MITRE

Techniques

Mitigations

Cybersecurity needs ?

Strengthen software security from the outset with our DevSecOps expertise

Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.

Discover this offer

Soutenez No Hack Me sur Tipeee